AgentGuards setup
Guide the user through finishing AgentGuards setup after installing the plugin. The plugin already bundles the MCP server and the enforcing hooks — the only thing the user must supply is their API key.
Steps
Check for the API key. Look for the
AGENTGUARDS_API_KEYenvironment variable. If it is missing or does not start withag_, tell the user to:Get a key from the dashboard at https://agentguards.co/dashboard/keys
Export it so both the MCP server and the hooks can read it. For the current shell and future sessions, add to their shell profile (
~/.bashrc,~/.zshrc, etc.):export AGENTGUARDS_API_KEY=ag_your_token_hereRestart Codex (or start a new session) so the MCP server and hooks pick up the key from the environment.
Confirm the URL (optional). AgentGuards defaults to
https://prod.agentguards.co. Only setAGENTGUARDS_URLif the user runs a self-hosted instance.Fail-open vs fail-closed. The hooks fail closed by default — if the AgentGuards service is unreachable, actions are blocked. A user who prefers availability over strict enforcement can set
AGENTGUARDS_FAIL_OPEN=true. Mention this only if they ask or report unexpected blocks.Verify. Call the AgentGuards
health_checktool from theagentguardsMCP server. Report whether the service is reachable and which key prefix is active. If it fails, the most common cause isAGENTGUARDS_API_KEYnot being exported in the environment Codex was launched from.Summarize what is now active: UserPromptSubmit input scanning, PreToolUse shell-command authorization, PostToolUse web-content scanning, and the
check_input/authorize_actionMCP tools.
Source: hashgraph-online/awesome-codex-plugins → plugins/alelaguard/agentguards-plugins/skills/setup/SKILL.md